The GitHub Actions job "CI" on grails-core.git/fix/cas-single-signout-and-proxy-receptor has failed. Run started by GitHub user sbglasius (triggered by sbglasius).
Head commit for run: 06d8801b2c225103c27cff25c9ea3b65b9eacec2 / Søren Berg Glasius <[email protected]> fix(cas): repair proxy receptor and single sign-out, add integration tests The CAS plugin had no tests at all, and its only exerciser was a bootRun-only demo pointed at a hand-run CAS server. Two defects were living in that gap. Fixes: * casAuthenticationFilter set proxyReceptorUrl unconditionally. Spring Security 7.1 rejects a null pattern, so an application that did not configure a proxy receptor - the default - failed to start. It is now only set when configured, which is how CasAuthenticationFilter expresses that proxy support is off. Previously the unguarded assignment produced a matcher for the literal path '/**null', quietly giving unconfigured applications a live proxy receptor. * Single sign-out never worked. The plugin set useSessionFixationPrevention to false from doWithSpring, but it declares loadAfter = ['springSecurityCore'], so the core plugin had already defined sessionAuthenticationStrategy from the original value. The session was still replaced on login, so CAS logout requests matched no session. The bean is now redefined from the CAS plugin as well, through the same BeanTypeResolver the core plugin uses so an application's sessionAuthenticationStrategyBeanClass override still wins. Behaviour change: * cas.useSingleSignout now defaults to false. Enabling it disables session fixation prevention, which an application should choose deliberately rather than inherit. The plugin warns at startup when it is enabled. Documented in the CAS configuration reference and in the Grails 8 upgrade guide. Tests: grails-test-examples-spring-security-cas-test1 now runs against a real Apereo CAS server started with Testcontainers, gated on Docker availability, and no longer needs an externally managed CAS server for bootRun either. An EnvironmentPostProcessor starts the container and supplies the CAS URLs before the context is built; the service and proxy callback URLs, which depend on the port the embedded server binds, are set once the server is up. Three configurations run via the existing TESTCONFIG idiom: 'cas' (proxy settings unset), 'casProxy' (full proxy-granting-ticket round trip) and 'casNoSingleSignout' (asserts the new default). Coverage spans the login handshake, ticket validation, role enforcement, proxy tickets obtained through AttributePrincipal, and single sign-out. Logout requests are posted from a cookie-less client, as CAS does, so the filter's behaviour cannot be confused with the session clearing that a failed authentication would cause anyway. Also fixes an unrelated pre-existing gap: 'Grails BOM Hibernate7 Micronaut.adoc' is generated and gitignored but was missing from the rat exclusions, so rat failed after any docs build. Report URL: https://github.com/apache/grails-core/actions/runs/32271608967 With regards, GitHub Actions via GitBox
